{"answers":{"affected":"","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-18497 exists.","fix":"No fix has been published for CVE-2026-18497 yet. Limit exposure of the affected software until one is available.","what":"CVE-2026-18497 is a high-severity memory corruption vulnerability in Sean Barrett (nothings) nothings stb, published on 7 Aug 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link."},"fix_prompt":"Check this codebase for CVE-2026-18497 and fix it if it is affected.\n\nWhat it is: CVE-2026-18497 is a high-severity memory corruption vulnerability in Sean Barrett (nothings) nothings stb, published on 7 Aug 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-18497 exists.\n\nAffected product: Sean Barrett (nothings) nothings stb. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-18497/ (Markdown: https://insights.sbomify.com/CVE-2026-18497/index.md)","id":"CVE-2026-18497","markdown":"https://insights.sbomify.com/CVE-2026-18497/index.md","name":"CVE-2026-18497","record":{"aliases":["DEBIAN-CVE-2026-18497","GHSA-fhqp-xwqm-2m94","UBUNTU-CVE-2026-18497"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["code_execution","denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"TrueType font library","requires_auth":"none","summary":"An attacker can cause a heap buffer overflow by providing a malformed TrueType font file to applications using the stb library, potentially leading to code execution or crashes.","user_interaction":"required","vuln_class":"memory_corruption"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"certcc","cpe":[],"cvss":{"score":7.1,"severity":"high","source":"cisa-adp","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","version":"3.1"},"cwes":[{"id":"CWE-122","name":"Heap-based Buffer Overflow"}],"description":"A heap-buffer-overflow vulnerability exists in the nothings stb TrueType library, up to version 1.26, that is used for parsing TrueType font files. The vulnerability exists in the stbtt__GetGlyphShapeTT() function within the nothings stb_truetype.h library when parsing malformed TTF (TrueType Font) files. The vulnerability resides in the glyph data parsing path.\r\n\r\nAn attacker can craft a malformed TTF file with an inflated endPtsOfContours value and truncate the remaining glyph data. When an application utilizing stb_truetype.h (such as various game engines or graphics software) attempts to load, bake, or render this malformed font via stbtt_GetGlyphShape(), the parser will attempt to read past the end of the glyph data buffer, triggering the out-of-bounds read.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"weaponised"},"has_fix":false,"headline":"The nothings stb TrueType library contains a heap buffer overflow vulnerability","id":"CVE-2026-18497","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"memory_corruption","year":"2026"},"n_packages":0,"n_references":4,"next":{"headline":"IBM WebSphere Application Server Liberty is affected by a privilege escalation","id":"CVE-2026-18499"},"packages":[],"prev":{"headline":"Booking Calendar \u003c= 11.4.3 - Unauthenticated Sensitive Information Exposure in 'WPBC_FLEXTIMELINE_NAV' AJAX Action","id":"CVE-2026-18496"},"products":["nothings stb"],"published":"2026-08-07","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"poc","technical_impact":"total"},"state":"PUBLISHED","updated":"2026-08-12","vendors":["Sean Barrett (nothings)"]},"summary":"An attacker can cause a heap buffer overflow by providing a malformed TrueType font file to applications using the stb library, potentially leading to code execution or crashes.","url":"https://insights.sbomify.com/CVE-2026-18497/"}